generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/mjpegdec: check bits per pixel for changes similar to dimensions

Browse Source 
Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c378d6a6d)

Conflicts:

	libavcodec/mjpegdec.c
(cherry picked from commit 94371a404c663c3dae3d542fa43951567ab67f82)

Conflicts:

	libavcodec/mjpegdec.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2014-10-03 01:50:27 +02:00
parent 3714036011
commit f7170c4832
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libavcodec/mjpegdec.c
View File

@@ -193,16 +193,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
int ff_mjpeg_decode_sof(MJpegDecodeContext *s) int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
{ {
int len, nb_components, i, width, height, pix_fmt_id; int len, nb_components, i, width, height, bits, pix_fmt_id;
/* XXX: verify len field validity */ /* XXX: verify len field validity */
len = get_bits(&s->gb, 16); len = get_bits(&s->gb, 16);
s->bits= get_bits(&s->gb, 8); bits= get_bits(&s->gb, 8);
if(s->pegasus_rct) s->bits=9; if(s->pegasus_rct) bits=9;
if(s->bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly if(bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly
if (s->bits != 8 && !s->lossless){ if (bits != 8 && !s->lossless){
av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n"); av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n");
return -1; return -1;
} }
@@ -222,7 +222,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
if (nb_components <= 0 || if (nb_components <= 0 ||
nb_components > MAX_COMPONENTS) nb_components > MAX_COMPONENTS)
return -1; return -1;
if (s->ls && !(s->bits <= 8 || nb_components == 1)){ if (s->ls && !(bits <= 8 || nb_components == 1)){
av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n"); av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n");
return -1; return -1;
} }
@@ -255,11 +255,14 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* if different size, realloc/alloc picture */ /* if different size, realloc/alloc picture */
/* XXX: also check h_count and v_count */ /* XXX: also check h_count and v_count */
if (width != s->width || height != s->height) { if ( width != s->width || height != s->height
|| bits != s->bits
) {
av_freep(&s->qscale_table); av_freep(&s->qscale_table);
s->width = width; s->width = width;
s->height = height; s->height = height;
s->bits = bits;
s->interlaced = 0; s->interlaced = 0;
/* test interlaced mode */ /* test interlaced mode */